5 ms·

This has been a can kicked for many a mile. First bush, then obama, and now trump. The undocumented and largely ignored effect of FISA is that it is quietly dr

This has been a can kicked for many a mile. First bush, then obama, and now trump. The undocumented and largely ignored effect of FISA is that it is quietly driving cryptography to unprecedented levels of adoption. OpenPGP is part of Yubikey now, granting the average user HSM level security for their encryption for less than $50. Google has increased their cipherstrength and offers several multifactor solutions as well as foreign agent attack warnings for journalists. GPG offers curve25519 in light of just the implication of poisoned NIST primes. Signal sidesteps bugged SMS in favour of a hardened PFS channel of OTR deniable communication in video, voice and text. Letsencrypt is working to blanket the world in affordable, quick, and easy crypto for any site desired. Finally, tor's many exploits have been patched, and the protocols weaknesses have given way to more secure tools like i2p. The government is largely focusing on iPhone at this point, and why not. Apple is an easy target to beat on for the woes of late stage capitalism and unchecked foreign policy, however any modern consumer tech company worth their salt has seen the writing for quite some time. Encrypt, and make sure you're out of the loop entirely.

ballenf 9y ago
I take no solace in typical cryptography as it does nothing to hide most metadata. Who I talk to, when, how often (and the same for websites visited) is way more sensitive in the collective than the contents of any single one of those interactions. Signal type apps hide both and are valuable, but without widespread adoption is meaningless to most people. I'm not against any of the progress you cite, but so long as people can be targeted based on metadata they are at risk. Once targeted, it becomes child's play to bypass the encryption that most people employ, whether through social engineering or side channel attacks (beyond Spectre-type) or governmental requests/threats to cloud providers.
- cryptonector 9y ago
  Crypto does nothing to prevent rubber hose attacks. And as you note, it is very difficult to prevent traffic analysis, that being the only thing the government really needs to find what it's looking for anyways.
  - deleted 9y ago
    [deleted]
- zrm 9y ago
  The thing that protects metadata is onion routing. It's somewhat understandable why that isn't already used for everything. The latency impact is not small and it's unlikely the network could take the load if everyone actually started using it for everything. But it's unfortunate it isn't being used more widely for messaging, where neither of those things are major problems.
cryptonector 9y ago
Trump has not signed this yet. It's not even on his desk yet IIRC. And he's tweeted about, implying that he disapproves.
- guelo 9y ago
  He also tweeted support.
  - Taniwha 9y ago
    he's a real genius, I'm sure he knows his mind, he claims to always be right
- Shivetya 9y ago
  damn, if he were to veto it I might have to like the man. was hoping Ryan and gang could have stuffed it but I guess its hard when bipartisan results is code for Washington vs the USA
rektide 9y ago
It wasn't kicked down the can for many years, because it wasn't known! It was a quietly authorized program Bush signed off on & that the DoJ authorized & no one knew anything more about. Congress didn't know any more than we did about it until Wired began writing up the program in 2012, a full decade after it began, talking about the massive massive data warehouse in Utah that the NSA was building with details provided by William Binney. And it wasn't until Snowden's 2013 leaks that the government really had to admit to what it was doing, had to fess up to the STELLAR WIND program, & that forced the creation of a more "regulated" system, supposedly protected by the as-we've-seen rubber-stamping FISA court. The government has been unable to regulate or consider this program, because it's been concealed & shadowy for a long long time, and could well have remained that way. Now Congress actually has some responsibility to the American people, and sadly, in spite of unbelievable stonewalling & unwillingness to disclose how many Americans, how many emails it sweeps up[1], in spite of terrifying provisions like "abouts" collection, Congress is somehow deciding that drastically expanding the program's scope & using it for non-terrorism purposes is OK. Congress is insane, completely derelict from duty. I don't really disagree. Bush, Obama, and Trump are all kicking this can down the road. But for Congress too to be soo willing to kick this down the road is really a shock. And you're exactly right. When FBI Director Christopher Wray gets up and says- encryption is a problem- he's far far less credible & we have far less chance to meet him part way, when the government seems so happy giving itself such unlimited unaccountable spy powers. Math is the only defense we have against this catastrophic, out of control authoritarianism, and we're not very liable to abandon or dismantle that shelter, when the US government seems unwilling to develop even an iota of restraint. I'd also point out the other tension: the US government is placing itself just as much at ends with Europe and the rest of the world as they are the technology world. The EU's Privacy Shield ongoingly takes issue with the US's seemingly ever growing 702 authorization to spy on everyone[2], and the question of revisiting the data-sharing arrangements that make much of it possible keeps coming up. The US was running on borrowed time as it was. This radical expansion of powers in this new 702 bill are only heightening the silently growing crisis. Congress and the military seem entirely unwilling to strike any kind of balance, seem unwilling to get even basic facts on what the size, scale and impact of the program really are, while increasing it's scope and scale. This is an untennable position, and I thank you for doing a really good job highlighting a lot of the irresolvable tensions the US Government has created for itself with this unaccountable unquestionable seemingly unlimited program. [1] https://www.thecipherbrief.com/column_article/dont-pass-surveillance-legislation-dark#.WlX-vO2BQqo.twitter https://www.thecipherbrief.com/column_article/dont-pass-surv... [2] https://techcrunch.com/2017/10/18/eu-uses-privacy-shield-review-to-press-for-reform-of-u-s-foreign-surveillance-law/ https://techcrunch.com/2017/10/18/eu-uses-privacy-shield-rev...
reaperducer 9y ago
As a point of clarity, the FISA court was established by the Carter administration in 1978. Though it's popular to say it was a Bush invention.

ballenf 9y ago

I take no solace in typical cryptography as it does nothing to hide most metadata. Who I talk to, when, how often (and the same for websites visited) is way more sensitive in the collective than the contents of any single one of those interactions. Signal type apps hide both and are valuable, but without widespread adoption is meaningless to most people. I'm not against any of the progress you cite, but so long as people can be targeted based on metadata they are at risk. Once targeted, it becomes child's play to bypass the encryption that most people employ, whether through social engineering or side channel attacks (beyond Spectre-type) or governmental requests/threats to cloud providers.

cryptonector 9y ago
Crypto does nothing to prevent rubber hose attacks. And as you note, it is very difficult to prevent traffic analysis, that being the only thing the government really needs to find what it's looking for anyways.
- deleted 9y ago
  [deleted]
zrm 9y ago
The thing that protects metadata is onion routing. It's somewhat understandable why that isn't already used for everything. The latency impact is not small and it's unlikely the network could take the load if everyone actually started using it for everything. But it's unfortunate it isn't being used more widely for messaging, where neither of those things are major problems.

cryptonector 9y ago

Trump has not signed this yet. It's not even on his desk yet IIRC. And he's tweeted about, implying that he disapproves.

guelo 9y ago
He also tweeted support.
- Taniwha 9y ago
  he's a real genius, I'm sure he knows his mind, he claims to always be right
Shivetya 9y ago
damn, if he were to veto it I might have to like the man. was hoping Ryan and gang could have stuffed it but I guess its hard when bipartisan results is code for Washington vs the USA

rektide 9y ago

It wasn't kicked down the can for many years, because it wasn't known! It was a quietly authorized program Bush signed off on & that the DoJ authorized & no one knew anything more about. Congress didn't know any more than we did about it until Wired began writing up the program in 2012, a full decade after it began, talking about the massive massive data warehouse in Utah that the NSA was building with details provided by William Binney. And it wasn't until Snowden's 2013 leaks that the government really had to admit to what it was doing, had to fess up to the STELLAR WIND program, & that forced the creation of a more "regulated" system, supposedly protected by the as-we've-seen rubber-stamping FISA court. The government has been unable to regulate or consider this program, because it's been concealed & shadowy for a long long time, and could well have remained that way. Now Congress actually has some responsibility to the American people, and sadly, in spite of unbelievable stonewalling & unwillingness to disclose how many Americans, how many emails it sweeps up[1], in spite of terrifying provisions like "abouts" collection, Congress is somehow deciding that drastically expanding the program's scope & using it for non-terrorism purposes is OK. Congress is insane, completely derelict from duty. I don't really disagree. Bush, Obama, and Trump are all kicking this can down the road. But for Congress too to be soo willing to kick this down the road is really a shock. And you're exactly right. When FBI Director Christopher Wray gets up and says- encryption is a problem- he's far far less credible & we have far less chance to meet him part way, when the government seems so happy giving itself such unlimited unaccountable spy powers. Math is the only defense we have against this catastrophic, out of control authoritarianism, and we're not very liable to abandon or dismantle that shelter, when the US government seems unwilling to develop even an iota of restraint. I'd also point out the other tension: the US government is placing itself just as much at ends with Europe and the rest of the world as they are the technology world. The EU's Privacy Shield ongoingly takes issue with the US's seemingly ever growing 702 authorization to spy on everyone[2], and the question of revisiting the data-sharing arrangements that make much of it possible keeps coming up. The US was running on borrowed time as it was. This radical expansion of powers in this new 702 bill are only heightening the silently growing crisis. Congress and the military seem entirely unwilling to strike any kind of balance, seem unwilling to get even basic facts on what the size, scale and impact of the program really are, while increasing it's scope and scale. This is an untennable position, and I thank you for doing a really good job highlighting a lot of the irresolvable tensions the US Government has created for itself with this unaccountable unquestionable seemingly unlimited program. [1] https://www.thecipherbrief.com/column_article/dont-pass-surveillance-legislation-dark#.WlX-vO2BQqo.twitter https://www.thecipherbrief.com/column_article/dont-pass-surv... [2] https://techcrunch.com/2017/10/18/eu-uses-privacy-shield-review-to-press-for-reform-of-u-s-foreign-surveillance-law/ https://techcrunch.com/2017/10/18/eu-uses-privacy-shield-rev...

reaperducer 9y ago

As a point of clarity, the FISA court was established by the Carter administration in 1978. Though it's popular to say it was a Bush invention.